Splunk Search

Dedup Question

enb_splunk
Engager

Hello Everyone,

Having a hard time finding the appropriate way to display data. I have duplicate data where one field is unique. I would like to dedup but leaving one instance of the unique value. 

Example of what I want to dedup:

field1field2field3field4
abcd
abce
abcf

 

Example of what I would like to see:

field1field2field3field4
abcd

 

Any help would be greatly appreciated.

Regards.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| dedup field1 field2 field3

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| dedup field1 field2 field3
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...